[fpoling]

Go also includes a database of known package hashes so altering git tag to point to another commit will be detected.